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REMARKS 

Reconsideration of the above-identified application in view of the 
amendments above and the remarks following is respectfully requested. 

Claims 1-40, 49-59, 61 and 62 are pending in the Application. Claims 1-40, 
49-59, 61 and 62 have been rejected. Claims 1 and 49 are now amended. 



Examiner argues that paragraphs 100-104 in Zuk disclose the two stage 
comparison that is claimed by the present application. Applicant, in response, 
disagrees for the following reasons. 

The first search in Zuk looks for protocol identification (for example 
821 for SMTP ) in the header of the message. Zuk does not change any data into 
a special form which may be used for improving the search. 

By contrast, the present application performs the first search on data that 
is converted to canonical form in order to perform a fast search. Page 16 lines 5- 
12 state "In a preferred embodiment of the present invention, the information 
within the digital medium is first pre-processed and transformed into a 
representation that facilitates fast comparison with the stored information 
items". 

Amended claim 1 of the present invention defines "comparing said 
information sequence in said format facilitating said relatively fast comparison with 
said prestored information items in said format facilitating said relatively fast 
comparison ..." 

Amended claim 49 of the present invention states: "wherever a match is found 
using said relatively fast comparison involving canonical representation, t hen 
comparing original text to make a second determination of a match. . ." 

The above claimed features are not to be found in Zuk. 



Response to arguments 
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The first search in Zuk looks for the protocol identification (for 



example 821 for SMTP) in the header of the message , the second search looks for the 
protocol specification (for example allowable actions for each protocol) in the data 
base. Thus, Zuk carries out two searches on completely different data\ the first search 
is performed on the header and the second search is performed on the data base . 
Furthermore each search looks for different information. The first search looks for 
protocol identification while the second search looks for a protocol specification that 
corresponds to the protocol identified in the first stage . By contrast, the present 
application as claimed looks for the same information in the same data item in both 
of the searches. The first search is performed while the data is transferred into a 
format facilitating fast comparison while the second search is performed while the 
data is in the original format. 



the second search is actually performed. Amended claim 1 of the present invention 
states: 

". . .when a match is found between said formats facilitating said relatively fast 
comparison then carrying out a said second relatively slower textual comparison..." 
The first search, of the present application, causes the second search to be needed less 
often. The second search is performed only when a match is found in the first search, 
in order to reduce the number of queries to the data base. Page 17 lines 20-23 and 
page 18 lines 1-2 states "Reference is now made to Fig. 2, which illustrates a system, 
substantially similar to the one described in Fig. 1, where a fast proof of non- 
existence module 155 is introduced between the scanner 150 and the comparator 160. 
The proof of non-existence module is operable to prove, with a probability P, that a 
certain item does not exist in the list in the storage 130, thereby significantly reducing 
the number of queries to the storage 130." 

Amended claim lof the present application states " when a match is found 
between said formats facilitating said relatively fast comparison then carrying out a 



A second difference between the searches is the number of times that 
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said second relatively slower textual comparison". Amended claim 49 states " and 
wherever a match is found using said relatively fast comparison involving canonical 
representation , then comparing original text". Thus the second search queries the 
database only when a match is found in the first search. The second search 
furthermore is carried out on the text itself that was the subject of the first search. 

By contrast the first search in Zuk is carried out for finding the protocols in a 
packet while the second search is performed for finding information regarding the 
protocols that were found in the first search. The first search does not cause the 
second search to be needed less often. Thus the skilled person in the art would not 
know how to use the first search in Zuk in order to improve the searching process by 
performing the second search less often. 

Thus the independent claims are believed to be novel and inventive. The 
dependent claims are believed to be allowable as being dependent on the main claims. 



that claims 1-40, 49-59, 61 and 62 are now in condition for allowance. A prompt 
notice of allowance is respectfully and earnestly solicited. 



In view of the above amendments and remarks it is respectfully submitted 



Respectfully submitted, 



/Jason H. Rosenblum/ 



Jason H. Rosenblum 
Registration No. 56,437 
Telephone: 718.246.8482 



Date: February 2, 2010 



Enclosure: 

• Petition for Extension (Three Months) 



